Spreadsheets and queries are local to a Space, so they inherit the same permissions.
|Space Permissions||Query permission||Spreadsheet permission|
|View||View, sort, filter*||View, sort, filter*|
|Create page||Can edit existing queries, but not save them||Can add and edit queries/ spreadsheets|
|Remove page||Can edit and save existing queries||Can remove spreadsheets|
Space Admin (if configured in Play SQL Settings)
or Confluence Admin
|Can edit the datasource||Can edit the datasource|
* Sorting and filtering is done in SQL. It makes it possible to use unfiltered SQL (which is intended), but it also makes it possible to call SQL stored procedures or anything that the SQL connection allows. If you want to ensure no other data is accessed, you need to use the "Space-level permissions" (see below).